Privacy Policy

Account information. If you create an account: your name, email address, and password (stored only as a one-way hash), your account role, and when the account was created and updated.

Sign-in sessions. When you sign in we store a session record, including the IP address and browser user agent used to sign in, and set a session cookie so you stay signed in.

Alert and API settings. Email alert preferences (which events and airports, whether alerts are on, whether your address is confirmed, when we last emailed you and any delivery error); webhook names, URLs, formats, filters, signing secrets and a log of the most recent deliveries (time, event, response status and the payload sent); and API key names, prefixes and last-used times. API keys are stored only as a one-way hash.

Usage and device information. Like most websites, our hosting provider automatically processes request information such as IP address, browser type, pages requested and timestamps to deliver and secure the Service. We use Vercel Web Analytics, which records aggregate page views without using cookies.

Messages to us. If you email us, we keep the message and your contact details to respond.

We do not knowingly collect sensitive personal information, precise location, or payment information.

• to provide the Service: create and secure your account, keep you signed in, send the alerts you set up, and authenticate API requests;
• to send service messages, such as alert confirmation emails and important notices about the Service or these policies;
• to operate, maintain, debug and improve the Service and understand aggregate usage;
• to protect the Service and its users, including preventing abuse, fraud and security incidents, and enforcing our Terms;
• to comply with law and respond to lawful requests.

We do not sell or rent personal information, and we do not use it for targeted advertising.

We share personal information only as needed to run the Service, with service providers that process it on our behalf:

• Vercel — website hosting, logs and web analytics;
• Neon — database hosting for accounts and alert settings;
• Resend — sending alert and confirmation emails (receives your email address and the email content);
• Upstash — caching FAA status data (no account information).

Webhooks send alert data to the URLs you choose; what happens there is governed by whoever operates that endpoint. AI summaries are generated from public FAA status data through OpenRouter; no personal information is sent. When you view the map, your browser loads weather radar images directly from the Iowa Environmental Mesonet (Iowa State University), which receives your IP address as part of that request.

We may also disclose information if required by law or legal process, to protect the rights, property or safety of GroundStop.app, our users or others, or in connection with a merger, acquisition or sale of all or part of the Service, in which case this policy will continue to apply to that information.

We use a strictly necessary session cookie when you are signed in. Your light/dark theme choice is saved in your browser's local storage. We do not use advertising or cross-site tracking cookies. Web analytics on the Service do not use cookies.

• Account information and settings are kept until you delete your account or ask us to.
• Sign-in sessions expire automatically and are then removed.
• Webhook delivery logs keep only the most recent deliveries for each webhook.
• Server logs and analytics are kept by our providers for limited periods under their own policies.
• We may keep information longer where required by law or to resolve disputes and enforce our agreements.

We use reasonable safeguards, including encryption in transit (HTTPS), hashed passwords and API keys, and signed links for alert confirmation and unsubscribe. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Keep your password and API keys confidential and tell us at support@groundstop.app if you suspect unauthorized access.

• You can turn email alerts off, or unsubscribe using the link in any alert email.
• You can edit or delete webhooks and revoke API keys at any time from the Alerts & API page.
• You can ask us to access, correct, export or delete your personal information, or delete your account, by emailing support@groundstop.app from your account's email address.

Depending on where you live (for example California or the EU/UK), you may have additional rights under local law, such as the right to know what we collect, to object to or restrict certain processing, and not to be discriminated against for exercising your rights. We will respond to verified requests as required by applicable law. Where the GDPR applies, we process personal information to perform our contract with you, for our legitimate interests in running and securing the Service, and to comply with legal obligations, and you may complain to your local data protection authority.

The Service is not directed to children, and you must be at least 18 to create an account. We do not knowingly collect personal information from children under 13. If you believe a child has given us personal information, contact us and we will delete it.

The Service is operated from the United States, and information is processed in the United States and other countries where our providers operate. By using the Service you understand that your information will be transferred to and processed in those places, which may have different data protection laws from your own.

We may update this policy from time to time. We will post the updated policy here and change the "Last updated" date; for material changes we may also notify you by email or in the Service.

Privacy questions or requests: support@groundstop.app.